What causes "namespace %q does not allow volumes to use node pool %q" in hashicorp/nomad?

Change the volume's NodePool to one allowed by the namespace, or omit NodePool to allow any permitted pool.

namespace %q does not allow volumes to use node pool %q

Error message

namespace %q does not allow volumes to use node pool %q

What it means

placeHostVolume enforces node pool governance: enterpriseNodePoolFilter builds a poolFilterFn from the volume's namespace (e.g. namespace's node pool allowlist). If the requested NodePool is not permitted for that namespace, the request is rejected before any node iteration.

Source

Thrown at nomad/host_volume_endpoint.go:572

			return nil, fmt.Errorf("no such node %s", vol.NodeID)
		}
		if ok := checker.Feasible(node); !ok {
			return nil, fmt.Errorf("node %s is not feasible for volume", vol.NodeID)
		}

		vol.NodePool = node.NodePool
		return node, nil
	}

	poolFilterFn, err := v.enterpriseNodePoolFilter(snap, vol)
	if err != nil {
		return nil, err
	}

	var iter memdb.ResultIterator
	if vol.NodePool != "" {
		if !poolFilterFn(vol.NodePool) {
			return nil, fmt.Errorf("namespace %q does not allow volumes to use node pool %q",
				vol.Namespace, vol.NodePool)
		}
		iter, err = snap.NodesByNodePool(nil, vol.NodePool)
	} else {
		iter, err = snap.Nodes(nil)
	}
	if err != nil {
		return nil, err
	}

	var (
		filteredByExisting    int
		filteredByGovernance  int
		filteredByFeasibility int
	)

	for {
		raw := iter.Next()

View on GitHub (pinned to 482b49bf1a)

Solutions

Change the volume's NodePool to one allowed by the namespace, or omit NodePool to allow any permitted pool.
Update the namespace spec to include the desired node pool in its allowlist (`nomad namespace apply -node-pools ...`).
Create the volume in a namespace whose governance matches the target pool.

Example fix

// before
nomad namespace apply -node-pools=prod team-a
volume spec: NodePool: "dev"
// after
nomad namespace apply -node-pools=prod,dev team-a  (or set NodePool: "prod" in the volume)

Defensive patterns

Strategy: validation

Validate before calling

ns, _, err := client.Namespaces().Info(vol.Namespace, nil)
if err != nil { return err }
if len(ns.NodePools) > 0 && !slices.Contains(ns.NodePools, vol.NodePool) {
    return fmt.Errorf("namespace %q forbids node pool %q", vol.Namespace, vol.NodePool)
}

Prevention

Keep the namespace's node pool allowlist in sync with volume specs.
Use IaC to manage namespace governance and volumes together.
Omit NodePool when unsure so placement uses governed candidates only.

When it happens

Trigger: Creating a host volume in a namespace whose allowed node pools (namespace.NodePools allowlist) do not include vol.NodePool — typically on Nomad Enterprise with per-namespace pool governance.

Common situations: Namespace configured to restrict workloads to certain pools while the volume spec targets 'all' or another pool; operator moved the namespace's allowlist after volumes were already specified; multi-tenant setups where teams create volumes in a shared namespace.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/9fbee5dd3e1fd8f1. Report an issue: GitHub.